292947 - Password manager needs to check isTrusted on DOMPageRestore events

Status: RESOLVED FIXED

(Toolkit :: Password Manager, defect)

Description

[Boris Zbarsky [:bzbarsky]]

This is a review comment from bug 274784:

  Also, what happens if content fires DOMPageRestore events?  Wouldn't autofill
  trigger on those?  Do we need some isTrusted checks here?

Comment 1

[Brian Ryner (not reading)]

This was actually addressed in the last patch I posted:

NS_IMETHODIMP
nsPasswordManager::PageRestore(nsIDOMEvent* aEvent)
{
  // Only autofill for trusted events.
  nsCOMPtr<nsIDOMNSEvent> nsevent = do_QueryInterface(aEvent);
  PRBool trusted = PR_FALSE;
  if (nsevent)
    nsevent->GetIsTrusted(&trusted);
  if (!trusted)
    return NS_OK;